ops(sync): add .npmrc to the file-sync map

[laurenhitchon]

Turns on the half of Phase 2 that was never wired up.

What I found

.nvmrc was already mapped in every group — my earlier read that Phase 2 was untouched was wrong. All 22 repos report 24.16.0, which also resolves the doc's stale caveat about dtl-sandbox and nswds-tokens running Node 22.

.npmrc was the missing half. Current state across the 22 sync targets:

	count
engine-strict=true by hand	8
no .npmrc at all	12
bespoke variants	2 (nswds-ui, ictds-portal-flows)

Two carve-outs, not a blind sync

nswds-ui gets a variant source (repo-files/.npmrc-nswds-ui). Its .npmrc is provenance=false, not engine-strict — npm only supports provenance for public source repos and this one is private. A whole-file sync of the canonical would reintroduce the E422 publish failure that, per its own comment, silently stranded v1.8.0–v2.1.0 as git tags that never reached npm. The variant preserves that directive verbatim.

It deliberately does not add engine-strict there: nswds-ui is a Turborepo monorepo whose workspace packages each declare their own engines, so enabling it should be a considered pass rather than a side effect of this change.

ictds-portal-flows' rationale is promoted, not destroyed. It had a 12-line explanation of why engine-strict matters written into its own .npmrc. That reasoning now lives in the canonical, so the sync spreads it to all 21 repos instead of stripping it from the one that had it.

Is adding engine-strict to 12 repos safe?

Yes, verified rather than assumed — every repo's .nvmrc is 24.16.0, and that satisfies every declared engines.node across the fleet. Nothing that installed before stops installing.

It is load-bearing going forward: it converts an engines warning nobody reads into a failure in the install / install job that rulesets already require. Without it, an innocuous .nvmrc edit could pass CI and then run unsupported code on main mid-release.

Verification

• .github/sync.yml parses as valid YAML; 5 groups intact
• Mapping confirmed: 21 repos → repo-files/.npmrc, nswds-ui → repo-files/.npmrc-nswds-ui
• nswds-ui variant preserves provenance=false exactly (diffed against its current file)
• deleteOrphaned still absent (only the warning comment)
• Sync workflow already triggers on repo-files/**, so no workflow change needed

Blast radius

Merging fans out chore(ci): PRs to 22 repos. They are PRs, not direct pushes — SKIP_PR: false — so each is reviewable before it lands.

[DFSIdigital]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR wires .npmrc into the existing repo-file sync system so the fleet consistently enforces Node engine floors via engine-strict=true, while preserving an explicit nswds-ui exception via a variant .npmrc source.

Changes:

• Adds a canonical repo-files/.npmrc (with engine-strict=true and rationale) and a repo-files/.npmrc-nswds-ui variant (with provenance=false and explicit non-use of engine-strict).
• Updates .github/sync.yml to sync .npmrc into each repo, using the variant source for nswds-ui.
• Updates docs/config-single-source-of-truth.md to reflect that .nvmrc is already synced and .npmrc is now synced (with the nswds-ui carve-out).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
repo-files/.npmrc-nswds-ui	Introduces the nswds-ui-specific .npmrc variant to preserve provenance=false and avoid engine-strict side effects.
repo-files/.npmrc	Establishes the canonical synced .npmrc with engine-strict=true and documentation explaining why it matters.
docs/config-single-source-of-truth.md	Updates the single-source-of-truth documentation to reflect current sync status and the .npmrc variant handling.
.github/sync.yml	Wires .npmrc into the sync map across groups, with nswds-ui pointing at the variant source.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[laurenhitchon]

Reopened as a new PR from chore/sync-npmrc — same commit, valid branch prefix. ops is an allowed commit type in commit-types.mjs but not an allowed branch type in scripts/branch-name-config.sh (feat|fix|hotfix|release|docs|build|test|refactor|style|chore|export|ai|copilot|cursor|claude|codex), so check-branch-name failed. Nothing wrong with the change itself.